RED TEAM Operator: Privilege Escalation in Windows Course by SEKTOR7 Institute

RED TEAM Operator: Privilege Escalation in Windows Course

Welcome to Privilege Escalation in Windows course!

Let's make it short.
You're interested in Windows security, right? Otherwise you wouldn't be here. You are either led by natural curiosity of security researcher or doing penetration testing professionally, or both. And maybe you need to get better understanding of how privilege escalation works in Microsoft environments.

So here's what's in the course.
It is indeed about escalating privileges in Windows. But it's not only about getting SYSTEM, as there are other shades of that tactic. From the course you'll learn about becoming another user, breaking out from Medium to High Integrity Level, or from High to System, and abusing privileges assigned to your access token to get more powers on the box.

You will get access to a complete testing environment with many misconfigurations and vulnerable services plus code templates with full building toolchain. As we usually do in SEKTOR7 it's a ready-to-use package prepared for any student who's willing to take some time and experiment and learn new things.

So if you're still interested, get on board, relax and take a great journey through the world of Windows security. You'll love it!


You Will Learn

  • 20 different techniques of Windows Privilege Escalation, like:
    • DLL Hijacking
    • Bypassing UAC
    • Misusing Windows Vault
    • Exploiting leaked handles
    • Hacking named pipes
    • Abusing access tokens
    • and much more...
  • How Windows Security Model works

Target Audience

  • Ethical Hackers
  • Penetration Testers
  • Blue Teamers
  • Threat Hunters
  • All security engineers/professionals wanting to learn advanced offensive tactics


  • Understanding of operating system architecture
  • Some experience with Windows OS
  • Basic knowledge about coding in C/C++
  • Computer with min. 4 GB of RAM + 30 GB of free disk space
  • VirtualBox 6.0+ installed
  • Strong will to learn and having fun


What's included?

Video Icon 28 videos File Icon 2 files Text Icon 3 text files


Intro and Setup
Introduction to Windows Security
10 mins
Intro Addendum
3 mins
Course VM Setup
4 mins
1.25 MB
"Low Hanging Passwords"
9 mins
"The X Files" - Interesting Files
5 mins
"Swimming in Hives" - Registry
4 mins
"A Boss with Creds" - Abusing Credential Manager
13 mins
"The King is Naked" - Robbing Credential Manager
4 mins
"A Thief" - Asking User for Creds
5 mins
Unsecured Objects
"Boundless Servant" - Unsecured Service [1]
9 mins
"Lonely Vassal"- Unsecured Service [2]
10 mins
"Hornets' Nest"- Unsecured Service [3]
10 mins
Execution Flow Hijacking
"Folding Papers"- Unsecured File System
17 mins
"Hi Jack, Show Me THE WAY" - Exploiting PATH
6 mins
"Closed. No Service" - Missing Service
6 mins
"Jobless" - Missing Task
10 mins
"Library Has Fallen" - DLL Hijacking
21 mins
"You Ain't Corner Me" - UACME
11 mins
Getting SYSTEM
"! NeverRemoveDepressed" - AlwaysInstallElevated Hack
8 mins
"Hi, Sis!" - New Service for SYSTEM
4 mins
"Nick Has a Leak: Prelude" - Leaked HANDLE [1]
4 mins
"Nick Has a Leak: Demon" - Leaked HANDLE [2]
12 mins
"Nick Has a Leak: Sequel" - Leaked HANDLE [3]
9 mins
"Chip & Dance: Prologue" - Abusing Tokens [1]
3 mins
"Chip & Dance Show" - Abusing Tokens [2]
6 mins
"Broken Calumet: Overture" - Exploiting Named Pipes [1]
4 mins
"Broken Calumet Exposed" - Exploiting Named Pipes [2]
8 mins
Assignment #1
Assignment #2
Assignment #3
Course Closing Information
3 mins

Instructor: reenz0h

Chief Research Officer at SEKTOR7. In the industry for over 20 years. Worked in global Red Team for almost a decade. Simulated threat actors targeting IT infrastructure across various industries (financial, technology, industrial, energy, aviation) around the world. Speaker at HackCon, PWNing, WTH@ck, Sec-T, T2, DeepSec. Gave guest lectures at several military and civil academies and universities.

Founder of x33fcon security conference
and SEKTOR7 offensive research company


How long is the course?

All videos are about 3.5 h long.

What language is used in the course?

All videos, text and materials are in English.

Is it on-line course only?

The course is composed of 2 types of materials. Videos, which are available on-line only, and virtual machine with source code templates, which can be downloaded and stored on your computer, so you can access it later off-line.

How long is the course available after purchase?

After you purchase the course, you have access to all the videos and materials without any time limit. You can learn whenever you want, the content will always await for you.
Moreover, any updates to the course materials (ie. new modules, new videos, new files, etc.) will also be available for anyone who purchased the course without any extra charge.

Do I have to be an expert in C language?

No. Although some level of experience in C programming reading is required, you don't have to be an expert in this field. Basic knowledge about the syntax, data structures and function calling convention is enough during the course.
For refresher check Windows API tutorial

I don't have Paypal account. What can I do?

We accept payments via Paypal and credit/debit cards. To use the latter, choose Paypal payment. You will get redirected to Paypal website where you can choose between PP and credit/debit card payment.

How can I get an invoice?

You can get an invoice after you purchase the course.
After logging into your account, first go to Account and fill out Your address (ie. company name, street, etc,). Then go to Billing and just download the invoice.

How to change VAT rate?

When you are registering in the course, you can choose VAT rate appropriate for your country (if you are from EU). After you supply your email, the system will present you a price with suggested VAT rate, and, if a tax rate is inappropriate or you do not qualify for VAT because of your tax residence, adjust the rate by clicking on update and chose your country of residence.

Can I get a Certificate of Completion?

Yes, Certificate of Completion will be provided on request (send an email to training+CoC @

Legal Disclaimer

All the materials are for educational and research purposes only.
Do not attempt to violate the law with anything contained in materials produced by Sektor7. Neither administration of this server, the authors of this material, or anyone else affiliated in any way, is going to accept responsibility for your actions.

By using and its contents, you accept that you will only lawfully use it in a test lab – with devices that you own or are allowed to conduct penetration tests for your customers and clients.

Do not abuse this material. Be responsible.